Prinz Eugen Ransomware - Suspicious Go Binary Execution

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•3

Detects the execution of a Go binary named 'servertool.exe' or any executable containing 'servertool' in its command line, when combined with suspicious command-line arguments indicative of file deletion or directory traversal, while excluding common system directories like 'Program Files' and 'Windows'. This rule aims to identify activity associated with the Prinz Eugen ransomware.